openssh unix dev - Jul 2010 - Capture Keystrokes

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi List,

This may be a little of an unorthodox question as it somewhat defeats
the purpose of encryption, but I'm currently attempting to put together
a high-interactive iPhone honeypot project as part of my thesis for a
masters course in security and forensics. The project blog is located at
http://iphonehoneypot.wordpress.com which details the project's
objectives and current status.

As it stands, I have one last element to implement and this is to
capture keystrokes from an established SSH session. I have looked at
various options; kernel modules, writing my own ssh service in python
using the twisted framework etc but I'd like to explore the possibility
of modifying openssh to record keystrokes to ensure authenticity. Can
anyone advise? Is this even possible? Are there other alternatives which
I haven't considered? i.e. can I generate a static key which I could use
to decrypt the captured traffic later?

Many Thanks,

A

- -- 

Alan Neville,
Postgraduate Education Officer,
DCU Students' Union 2009/2010,
BS.c Computer Applications DCU (Completed)
MS.c Security and Forensics DCU (Attending)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJMPITVAAoJEJ1FG8f8Uulu+9sH/0csr66PH4UfUc+peBL3eSZj
j0nOvxB8vTwcBR57G7TjmYMfC29czkIIZKvcMGJ1JjwTg1GlGbVSZxfryUubcuEQ
xUCBBf9DrTlgs/GrPqjXTwwL4CsMr9fjlZtj0ir95s5yf4hDkcXqB7MMWDBaqPdK
z7BZ0vPElU7jPOia1zIyRdfT/9Ooq53sD8sukWrABdgrCvzwb9JalV9mNEj2st+Y
hTRBSURLHY/lwNgoqwfTJIH4YpeGC9D6qpgBE6HOrKoTFDUtHsWbBU7KUvoZ/Izn
GAvutTdEMd+0qF2yK97krwxDW/7JW7/83aKGZT4sScYzAxzZWN97yhKrZn+kVrc=rmVf
-----END PGP SIGNATURE-----

Alan Neville wrote:
> capture keystrokes from an established SSH session.
..
> I'd like to explore the possibility of modifying openssh to record
> keystrokes to ensure authenticity.
Authenticity of what?

Would you want to modify the client or the server? I guess the
server. Maybe you would be interested in:

http://freshmeat.net/projects/ttysnoop26/

> can I generate a static key which I could use to decrypt the
> captured traffic later?
Not with protocol version 2.


//Peter

On Tue, 13 Jul 2010, Alan Neville wrote:
> As it stands, I have one last element to implement and this is to
> capture keystrokes from an established SSH session.
You control the ssh server, right?  Then configure it to run the user's
shell inside a keystroke recorder.  I suggest using NetBSD's version of
the "script" program, because it has options that let you record both
directions, and associate a timestamp with each chunk of captured data.

You should be able to compile NetBSD's version of script
under some other BSD, or maybe even Linux, without
much trouble; you can get the files from cvsweb here:
<http://cvsweb.netbsd.org/bsdweb.cgi/src/usr.bin/script/>.

--apb (Alan Barrett)